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FOREWORD 


The authors wish to acknowledge the efforts of Mr. Norman R. Schulze, Code Q, NASA Headquar- 
ters, who provided the impetus and funding for this manual. Mr. Morry L. Schimmel, the coauthor of 
this paper, had a distinguished career with McDonnell Douglas until 1984 and provided consultantion to 
Langley Research Center until his death in 1995. Mr. E. R. Lake, Ray Lake Company, St. Louis, 
Missouri, contributed to Chapter 5, Initiation Systems/Initiators. This manual has provided the text for a 
2-day short course taught in conjunction with the American Institute of Aeronautics and Astronautics 
(AIAA). 
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Chapter 1.- INTRODUCTION 


Although pyrotechnic devices have been singularly responsible for the success of many of the criti- 
cal mechanical functions in aerospace programs for over 30 years, ground and in-flight failures continue 
to occur. Subsequent investigations reveal that little or no quantitative information is available on mea- 
suring the effects on performance of system variables or on determining functional margins. The three 
following examples amplify these points. A pin puller design, that was used for the successful deploy- 
ment of an antenna on the surface of Mars in 1976 in the Viking Lander Program, failed to function in a 
second application in 1986 and was abandoned. A spacecraft separation joint failed to function in a 
1984 ground test after more than 20 years of flight successes; the same joint, which is designed for full 
containment of explosive products, burst in 1994 during release of a payload from the Space Shuttle 
cargo bay. A “fully qualified” valve design, that was created for the Gemini Program in the early 
1960’s, structurally failed and ignited hydrazine in 1994 through previously unrecognized failure 
modes. Improved guidelines for pyrotechnic design, development and qualification are clearly needed. 


The purpose of this manual is to provide an overview of and recommendations for the design, 
development and qualification of pyrotechnic components and the systems in which they are used. This 
is a complex field in which there are few specialists and even fewer guidelines on the approach to create 
a device and assure it will perform its required task. The field of pyrotechnics is generally considered to 
be an art, not a science or engineering discipline. Also, pyrotechnics are considered to be readily avail- 
able, and, therefore, can be managed by any subsystem in which they are applied, such as structure, pro- 
pulsion, electric power or life support. This presentation is intended to dispel these misconceptions. 


The objectives of this manual are: 
(1) Remove the art from pyrotechnic applications. 
(2) Introduce engineering approaches. 


(3) Provide the logic for improved procurement, design, development, qualification, integration 
and use. 


Tests methods and logic are recommended that quantify performance to improve widely cited go/ 
no-go testing of under and over-loaded energy sources. References are noted throughout to allow the 
reader to obtain more detailed information on all test methods. 


This manual does not provide “cookbook” answers and approaches for any aspect of pyrotechnic 
operations. Not only are devices unique, requiring individualized approaches for design, development 
and qualification, but systems and operational procedures are also specialized. The contents of this man- 
ual are not intended for direct incorporation into pyrotechnic specifications. 


Chapter 2.- PYROTECHNICS DEFINITION, CONSIDERATIONS FOR 
APPLICATIONS 


2-1 Definition of Pyrotechnics 


In aerospace technology pyrotechnics refer to a broad family of sophisticated devices utilizing 
explosive, propellant and pyrotechnic compositions to accomplish: 


initiation 


release 


severance/fracture 


jettison 


valving 


switching 


time delay 


actuation 


Reference 1 


The first use of the term “pyrotechnics” for explosive and propellant-actuated devices in the aero- 
space field was by Harry Lutz of McDonnell Aircraft Company during the Mercury program. In 
response to a concern voiced by program management about using explosive devices in close proximity 
to the astronaut, Harry said, “Don’t call them explosives, call them pyrotechnics.” This was quickly 
shortened to “pyros,” which sounded evenless threatening. 


2-2 Pyrotechnics Are Extensively Applied Because of Their High Efficiency 
¢ High energy delivered per unit weight 
¢ Small volume, compact 
¢ Long-term storable energy 


* Controllable initiation and output energies 
Reference 1 


Few sources of energy combine all four of these attributes. Pyrotechnics contain the needed energy 
to accomplish a desired function within small volumes. The only external energy required is an initia- 
tion input. Initiation inputs to devices (mechanical, electrical, pneumatic, explosive transfer or laser) 
can be precisely established to prevent inadvertent initiation, as well as to assure adequate initiation 
energy. Pyrotechnics utilize solid material compositions that are highly energetic and can be selected to 
be stable under extremes of both thermal and vacuum conditions. 


2-3 Although Successful, Pyrotechnics Are Reluctantly Used 
¢ Unique Characteristics 
¢ Single shot 
¢ Cannot be functionally checked before flight 
¢ Short-duration, impulsive loads (pyrotechnic shock) 
¢ Safety issues 


* Contain explosive materials 


¢ Inadvertent functioning: 
* only small forces sometimes required to initiate 
* static electricity 
¢ lightning 
¢ electromagnetically induced energy 
* stray energy in firing circuits 
¢ Limited engineering approaches/standards are available for pyrotechnic applications 
* Cannot apply approaches for commonly used energy sources (electric, hydraulic, pneumatic) 
¢ Lack of test methods and logic to demonstrate functional margin 
* Go/no-go testing 
¢ Failures continue to occur 
¢ Lack of understanding of mechanisms 
¢ Poor or no resolution of failures 
¢ Few sources for information (reliance on manufacturers) 


* Reliability estimate based on successful qualification 
References 1, 2, 3 and 4 


Clearly, the advantages of using pyrotechnics often outweigh this burdensome list of disadvantages, 
concerns and challenges, or there would be no applications. In the early stages of the Shuttle program, 
an edict was made that there will be no pyrotechnics used for the vehicle or for payloads. Pyrotechnics 
violate one of their first ground rules, which is that systems shall be reusable. However, over 400 pyro- 
technic components fly on each Shuttle mission with some used on each flight and others only for emer- 
gencies. A primary requirement for Shuttle payload pyrotechnics is the assurance that on functioning, 
the Shuttle will not be damaged. 


Pyrotechnics normally are used only once, since often internal structural deformation is incurred in each 
firing. These devices cannot be cycled like solenoid-actuated switches to assure their functionality. The 
best assurance of successful operation is that the devices are designed with functional margins and have 
been accurately manufactured. 


The explosive, propellant and pyrotechnic-composition energy sources will burn completely and 
quickly no matter if the ignition input is intentional or inadvertent. Selecting low- level energy inputs to 
ignite these materials is a weight advantage, but can be a safety hazard. 


There are few guidelines for the design and application of pyrotechnic devices. There is a lack of 
accepted test standards to evaluate functional performance of devices. Existing methods generally rely 
on go/no-go testing, which means that a device either does or does not work. 


No college courses are offered for this sophisticated aerospace field, and past experience in other energy 
sources cannot be applied, primarily due to the single-shot, dynamic nature of pyrotechnic devices. 
Consequently, mission- critical functions are sometimes entrusted to pyrotechnic devices with less than 
the required reliability. The lack of understanding of these devices can lead to failures, as well as inade- 
quate failure resolution. Since there are few sources of information, users are forced into a reliance on 
manufacturers. In using “off-the-shelf” hardware, component functional and system evaluation is often 
minimized with the assumption that qualification exists. Furthermore, manufacturers may have a 
different view of success than does the user. Should a failure occur, there is a conflict between finding 
out the exact cause and getting on with the program schedule. 
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Statistical reliability and confidence is usually based on information compiled by the manufacturer in 
functional evaluations on any particular device and on its predecessor designs. To achieve a statistical 
basis for a 99.9% reliability with a 95% confidence level, more than 2000 identical devices would have 
to be evaluated. Such a number is often cost prohibitive. 


Chapter 3.- PYROTECHNIC FUNCTIONAL PRINCIPLES 


¢ Majority of pyrotechnically actuated functions accomplished through piston/cylinder devices 
¢ Other functions accomplished by linear explosives 

¢ Figures 1 through 14 show basic principles 

¢ Tables I and II show past applications 


References 1, 5, 6, 7, 8 and 9 
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Figure 1. Cross sectional views of pyrotechnically actuated linear actuators, describing function. 
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Figure 3. Cross sectional views of pyrotechnically actuated separation nuts, describing function. 
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Figure 4. Cross sectional views of explosive and pyrotechnically actuated separation bolts, describing 
function. 
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Figure 5. Cross sectional views of pyrotechnically actuated cutters of guillotines. 
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Figure 6. Cross sectional views of mild detonating cord (MDC)-actuated severance and separation 
approaches. 
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Figure 7. Cross sectional views of flexible linear shaped charge (FLSC) severance. 


Table I. Major Past and Current Pyrotechnic Applications in Aeronautics 


NUMBER OF 
PROGRAM AIRCRAFT INSTALLED 
PYROTECHNIC DEVICES USED 


F-4 (DUAL PLACE! 
(EXCLUDING SAMAMENT 
REQUIREMENTS) 


F-111 CREW MOOULE 


F-14 (DUAL PLACE) 


(EXCLUDING ARMAMENT 
REQUIREMENTS) 


F-15 (SINGLE PLACE} 
{EXCLUDING ARMAMENT 
REQUIREMENTS) 


F-4 ARMAMENT 

CARTRIDGE REQUIREMENTS 
FOR 4 MISSION CONFIGURATION 
OF (24) 500 LB BOMBS AND 4 
SPARROW MISSILES 


Table I. Major Part and Current Pyrotechnic Applications in Astronautics 


NUMBER OF SPACECRAFT 
PROGRAM INSTALLED PYROTECHNIC 
DEVICES USED 
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Figure 8. Cross sectional view A-A on right of F-111 crew module severance system. 
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Figure 9. Functional depiction of Rotor Systems Research Aircraft (RSRA) in-flight escape system. 
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Figure 11. Depiction of pyrotechnic devices used on Project Gemini. 
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Figure 12. Depiction of pyrotechnic devices used on the Command Module and escape system, Project 


Apollo. 
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Figure 13. Depiction of pyrotechnic devices used on the Lunar Excursion Module, Project Apollo. 
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Figure 14. Shuttle Transportation System pyrotechnics. 
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Chapter 4.- PYROTECHNIC, PROPELLANT AND EXPLOSIVE MATERIALS AS 
ENERGY SOURCES 


Energy delivery affected by burn rate 


¢ Time delay trains (pyrotechnic mixes): inches/second 
¢ Double-base propellant: inches/second 
¢ Metal/metal oxides: hundreds of feet/second 
¢ Primary explosives: less than 10,000 feet/second 
¢ Secondary explosives: over 20,000 feet/second 
¢ Wide range of energy characteristics 
¢ Energy delivered in various forms: heat, light, gas 
¢ Minimal to intense heat production 
* Gas evolution: gasless to millions of psi 


¢ Time to peak pressure less than microsecond to seconds 


Combustion affected by: 

¢ Density and particle size of burning material 
¢ Initial free volume 

* Confinement 

¢ Shape of the volume 

¢ Heat transfer characteristics 


¢ Changing volume (stroking piston) 


Energy delivery can be tailored to meet a very wide range of performance by adjusting the above 
parameters 


Reference 4 


The primary influence of energy deliverable by pyrotechnics, propellants and explosive is burn rate. As 
the burn rate changes, so do the products of the combustion. The forms of energy delivered are heat, gas 
and light, depending on the material or combination selected. Pyrotechnic compositions produce intense 
heat and often intense light with very little gas production. Propellants are used to deliver high- pressure 
volumes of gas, often with only moderate heat. Primary explosives rapidly (microseconds) develop hun- 
dreds of thousands of psi of gas pressure, while high explosives develop millions of psi in even a shorter 
time frame, with very little heat production. 


The combustion of these materials is affected by a number of parameters. Compacted small particles 
will burn faster than larger particle sizes at the same density. Of course, with loose-particle combustion, 
the larger the surface area, the more rapid the combustion. Gas producing materials are generally 
affected by ambient pressure; the higher the ambient pressure, the faster the burn rate. Consequently, 
propellants ignited in a large free volume must first pressurize the volume, before the ambient pressure 
is raised sufficiently to increase the burn rate. The shape of the volume in which reactions occur affect 
heat transfer within the combustible material itself, as well as transferring heat to surrounding structure. 
The greater the surface area and thermal transfer properties of the container, the more heat loss and 
reduction in burn rate of the material. An increasing volume, such as a stroking piston reduces burn rate 
by lowering ambient pressure, as well as increasing the surface area exposed to the hot gas. Energy 
delivery characteristics can be tailored over a wide range by adjusting the above parameters. Tables II 
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through VIII describe the properties of several widely used pyrotechnic, primary explosive and second- 
ary explosive materials. 


TABLE III.- Properties of a Time-Delay Mix (D-16, MIL-M-21383) 


¢ Formula: Ingredient % by Weight 
Manganese 37 
Barium Chromate 20 
Lead Chromate 43 


Burn rate: 8.7 seconds/inch 


Virtually gasless output 


Stability: Extended service life results in longer delay 


Application in sequencing pyrotechnic functions 
Reference 10 


TABLE IV.- Properties of a Gas-Generating Material (Hercules Hi-Temp) 


¢ Formula: Ingredient % by Weight 
RDX 80 
Nitrocellulose 20 
¢ Gas Composition: CO 33.5 
CO, 15.1 
Hy 0.8 
H,O 17.2 
N> 32.4 
Other 1.0 


Stability: less than 1% weight loss in 5 hr. at 275°F 


(Source: Hercules Incorporated) 


RDX sublimes under vacuum (shouldn’t be used for deep- space applications; container seal is a 
single-point failure) 


Sensitive to ambient pressure for ignition and burning (higher rate at higher pressures) 


Application as gas generating source for cartridges 


TABLE V.- Properties of Boron/Potassium Nitrate (B/KNO3) 


Gas generating material 


Burn rate minimally affected by ambient pressure 
¢ High-temperature combustion, hot particles 

¢ Thermally stable 

¢ Vacuum stable 

¢ Long shelf life 


¢ Application as rocket motor igniter and gas generator 
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References 11 and 12 


TABLE VI.- Properties of NASA Standard Initiator (NSD Mix 

¢ Zirconium/potassium perchlorate (Zr/KC1O4) 

¢ Burn rate of hundreds of feet/second 

¢ Rapid pressure rise 

* Output = hot particles, little gas 

¢ Electrostatically sensitive 

* Good hotwire initiation interface 

¢ Thermally and vacuum stable 


¢ Long shelf life 


Application as an initiator and as an energy source 


References 4 and 13 


TABLE VIL.- Properties of Lead Azide 


Transfers from a deflagration to detonation, short distance (about 0.1 inch) 


Detonation rate of about 7,000 feet/second 


Thermally stable (except for desensitizing agents: dextrin) 


Vacuum stable (except for dextrin) 


Long shelf life 


Sensitive to impact, friction and electrostatics 


Application in detonators to initiate a high-explosive output 


References 14, 15 and 16 


TABLE VIII.- Properties of Hexanitrostilbene (HNS) 


Detonates at a propagation velocity of 22,000 feet/second (32,000 psi compaction pressure) 


Thermally stable 


Vacuum stable 


Insensitive to non-explosive stimuli 


¢ Application in detonators, linear explosives and bulk charges 


References 16, 17 and 18 
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Chapter 5.- INITIATION SYSTEMS/INITIATORS 


The basic initiation systems for aerospace systems are: 


e Electrical 


Explosive transfer 


Mechanical 
e Shock tube 
Hot Gas 


e Laser 


5-1 Electrical Firing System Characteristics 


Provide reliable electrical energy to initiator 
¢ Direct current 


* Capacitor discharge 


Protect against inadvertent initiation 
¢ Shielding: lightning, static electricity, radio frequency, electromagnetically induced energy 


e Two-fault tolerant switches 


Control/sequence firing commands 


Provide electrical isolation from other electrical circuits 


Greatest safety consideration is final connection to device 
e Assure no energy in circuit 


¢ Remove shield from device and install final connector 
References 19, 20 and 21 


5-1-1 Electrical Initiator Characteristics (NASA Standard Initiator (NSD, figure 15) 


Convert electrical energy to heat to ignite “first- fire” through high-resistance bridgewire 
¢ Direct current 


* Capacitor discharge 


Provide reproducible initiation characteristics 
* No-fire energy; 1-amp/1-watt, five minutes 


¢ Predictable ignition delay for recommended firing energy 


Prevent inadvertent initiation 
¢ |-amp/1-watt no-fire dissipation 
¢ Stray energy (transients, radio frequency, electromagnetic) 


¢ Electrostatic discharge 


Provide electrical isolation from structure 


Provide ignition for pyrotechnics, propellants and explosive trains 


Sometimes used as sole energy source for small mechanisms 


Provide post-fire seal 


References 4 and 13 
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5-1-2 Exploding Bridgewire (EBW) Initiator 
¢ Uses low-resistance conductor (gold) bridgewire 
¢ Uses internal spark gap to prevent conducting low voltage and current levels through bridgewire 


¢ Uses several thousand-volt capacitor discharge firing system, which couples through internal spark 
gap 
Bridgewire vaporizes (explodes) to provide an impulse to directly initiate secondary explosives 


Eliminates the need for sensitive initiation materials and primary explosives 


Provides post-fire seal 


Major drawbacks are bulky, heavy power supplies, capacitors, switches and cables 


5-2 Mechanical Initiation System Characteristics 


Provide mechanical input to initiator (primer) 
¢ Spring compression/release 
¢ Pneumatically driven 


¢ Impact driven 


Provide firing pin interface to primer 


Prevent inadvertent functioning of initiation handles 
¢ Two-step operation (squeeze/pull or rotate/pull) 


¢ Minimum force and stroke required 


Assure adequate energy to initiate primer 
¢ Threshold pneumatic and impact energy 


¢ 2x (50% firing energy level + 5 standard deviations) 


Provide post-fire seal 
Reference 22 


5-2-1 Mechanical Initiator Characteristics (M42 Percussion Primer example) 


Convert mechanical energy to ignite primer mix 


Primer composition ignited by crushing/friction between cup and anvil 


Provide reproducible initiation characteristics 

¢ No-Fire (1.92-ounce ball drop): 
50% firing level drop height minus 2 standard deviations 
shall not be less than 2 inches (3.84 inch-ounces) 

¢ All-Fire (1.92-ounce ball drop): 
50% firing level drop height plus 5 standard deviations 
shall not exceed 13 inches (25.49 inch- ounces) 


¢ 50% firing level approximately 10 inch-ounces 


Provide ignition output (heat, gas, light, burning particles) 


Provide post-fire seal 
¢ Primers themselves not sealed; must be sealed by assembly into which it is installed 
Figure 16 shows percussion primer designs. 


Reference 22 
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Figure 15. Cross sectional view of NASA Standard Initiator (NSD). 


Figure 16. Views of commercial or military center-fire percussion primers. 
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5-2-2 Stab Primer 
¢ Used where full containment not necessary 
¢ Sharp firing pin penetrates through cup 
¢ Achieves ignition by fracture/friction of primer composition 
¢ Input energy generally less than needed for percussion primer 


* Output comparable to percussion primer 


The Separation Plane Initiator Assembly (figure 17) has a number of valuable design features to assure 
operational safety and reliability. The “remove before flight” Pip Pin prevents any motion of the Firing 
Pin. The expanded diameter of the Sear assembly shoulders on the bore of the Primer Pin Yoke, pre- 
venting Firing Pin displacement and contact with the Percussion Primer. The Spring was preloaded to 
keep the Sear assembly shoulder engaged, preventing rattle. The energy content in the Spring in inch- 
pounds is determined by the equation 1/2kX2, where k is the spring constant and X is the compression 
distance. When the Wire Rope pulls on the Sear, the Spring is compressed. The Sear releases the firing 
pin, as the Sear clears the Primer Pin Yoke, allowing the Sear’s angular interlocking finger to slide off 
the corresponding finger on the Firing Pin. The Support Disc prevents too great a penetration by the Fir- 
ing Pin into the Percussion Primer. 
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Figure 17. Cross sectional view of separation plane initiator for Delta Launch Vehicle. 
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5-3 Hot Gas System Characteristics 


¢ Gas generators pressurize pneumatic system plumbed to initiate each aircraft system function (canopy 
jettison, crewmember retraction, seat ejection, etc) 


¢ Mechanically initiated primer to gas generator 

¢ Device shear pin retains firing pin prior to stroke 

* Gas pressure at device 1000 psi minimum; shear pin fails at about 500 psi 

¢ Gas generator boosters used for large volumes and for long lengths of tubing 


¢ System pressure integrity critical 


5-4 Explosive Transfer Line Characteristics 
¢ Explosive impulse is transmitted to each system function by mild detonating fuse within steel tubing 
¢ Identical booster charges in thin-walled cups (tips) at each end of line 
¢ Initiation of input booster causes detonation propagation through explosive cord to initiate output tip 
¢ This tip creates a pressure impulse and fragments to initiate the next line 
¢ Tip output can also be used to accomplish work 


¢ Explosive transfer lines can also be flexible with fiberglass and steel overbraid for containment of 
explosive products 


¢ Transfer lines plumbed together like high-pressure tubing; free rotating nut on inside shoulder of each 
tip allows threading/seating into receiving ports 


¢ Steel tubing allows assembly to be hermetically sealed by welding cups to tube 
¢ Insensitive to initiation by lightning, RF, EMI and bullet impact 


¢ Will burn in fire, but will not build to detonation 


References 5, 23, 24 and 25 
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Figure 18. Cross sectional view of rigid explosive transfer line, also called shielded mild detonating 
cord (SMDC). 
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Rigid explosive transfer lines (figure 18) for high- temperature environments and the technology for 
their use were developed for the F-111 escape system in the early 1960’s. Explosive transfer from 
donors to acceptors is primarily accomplished by cup fragments. The sketches in figure 19 show the 
explosively driven shrapnel patterns produced as the end tip cup explodes. The sketches in figure 20 
show the gaps at which explosive transfers were accomplished. The shrapnel fragments produced off 
the end (bottom) of the cup proceed across the gap through the air in a contoured front with approxi- 
mately a one-degree divergence. As these fragments impact against an acceptor tip, a sufficiently high 
impulse is introduced into the acceptor tip to initiate detonation in the explosive. The donor cups must 
be fully annealed after forming to produce the fragment patterns shown in figure 19, so as to maximize 
the reliability of transfer. Although gaps to five inches are indicated between donor and acceptor, a 
maximum gap of 0.250 inch is recommended to accommodate the limits of variables, such as cup wall 
thickness and properties, cup breakup, and explosive density. In the “end to side” configuration, the 
cylindrical side of the acceptor tip is a poorer target; on- coming fragments can be deflected, reducing 
the amount of energy transferred into the acceptor. In the side-to-end transfer mode, the fragments pro- 
duced off the sides of the cylindrical cup are strips, like barrel staves. With the radial expansion of these 
fragments, appreciable gaps occur between fragments. Note, gaps must be at least 0.006 inch to allow 
the formation of fragments; this phenomenon can be explained through the realization that the cup has 
to expand slightly before it bursts to create high-velocity fragments. 


End View 


Figure 19. Views of SMDC tip fragment dispersion. 
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Figure 20. Gaps at which SMDC fragments initiated acceptors; donors and acceptors identical. 


5-5 Shock Tube System Characteristics (Thin-Layer Explosive (TLX)) 


¢ Shock pulse (6500 feet/second) is transmitted to each function in the system through plastic tube with 
interior thin layer coating composed of HMX and aluminum (50/50) 


¢ Deflagrating material in input of assembly is initiated by primer or other means 


¢ Output cup can contain deflagrating material to transfer the impulse to the next line or can contain 
explosive material to initiate high explosive functions 


¢ Tube can be initiated by some projectile impacts 
Reference 26 


The main advantage of the Thin-Layer Explosive (TLX) approach over explosive transfer lines is in 
weight. Since the shock wave is less energetic, explosive containment is more easily accomplished. 
However, this approach lacks the maturity of explosive transfer lines, and difficulties have been experi- 
enced in its application. Care must be taken to assure adequate margins in line initiations in multi-port 
manifolds. 
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5-6 Laser System Characteristics 
* Coherent light transmitted to all functions within a system through fiber optic cables 
* Coherent, high-intensity light generated by lasing gas, rods and diodes 
¢ Light transmitted through connectors and window in initiator or pigtail fiber 
¢ Window and pigtail are sealed to prevent venting 


¢ Fiber optic cables insensitive to lightning, RF, EMI and bullet impact 
References 27 and 28 


The major thrust of laser-initiated pyrotechnic devices is the virtual impossibility of initiating devices 
with anything but the coherent light. This allows installation of the pyrotechnic charges early in the 
assembly of subsystems and systems, such as is accomplished with explosive transfer lines and explod- 
ing bridgewire devices. Laser systems can safely allow early installation with weight savings over the 
above-mentioned systems. However, a price is paid; system complexity and electrical energy consump- 
tion is increased. Although laser diodes are small enough to provide a lasing source for each pyrotechnic 
device, eliminating the need for complex mirrors or switching mechanisms, the electronics necessary to 
power the diodes are more sophisticated and consume considerably more energy than those needed to 
directly fire a hot bridgewire system. This system also lacks a significant flight history. Definitions and 
standards are currently being developed to assure functional margins at field connectors and at inter- 
faces to the pyrotechnic charges. Range safety personnel have yet to establish safety and operational cri- 
teria. For example, is a physical light barrier or an open electrical switch required to assure the system is 
“safed,” as has been required for electrical and explosive initiation systems? 


24 


Chapter 6 - PYROTECHNIC SYSTEM SAFETY 


6-1 Properties of Materials 
¢ Explosive/pyrotechnic and propellant material safety properties established by: 
¢ Impact sensitivity 
¢ Thermal stability (autoignition temperatures and rates) 
¢ Vacuum stability 
¢ Electrostatic sensitivity - Friction sensitivity 
* Compatibilities with other materials 
¢ Aging characteristics 
¢ Explosive input initiation sensitivity 


¢ Safeguards for initiation systems mentioned above 
References 14 and 15 


Elaborate procedures have been established (usually with military specifications) to provide compara- 
tive information on each of the above properties for raw materials. For example, lead azide often has 
desensitizing agents mixed into it, and it is shipped under water, to reduce the opportunity of inadvertent 
initiation. Also, loading facilities are designed to accommodate inadvertent initiations; no matter what 
care, procedures and logic are applied, initiations can occur. However, once lead azide is properly 
loaded in sealed, electrically conductive containers made of compatible materials, it is very stable. 


6-2 Safe/Arm Devices 
¢ Safe/arm devices provide configurations for: 
¢ Input isolation (safe) 
¢ Input transfer (arm) 
¢ Actuation accomplished by electrical input, mechanical input, or both 
* Electrical 


¢ Safe = ganged electrical switches to short circuit and electrically ground firing leads to 
components 


¢ Arm = same switches open shorts and connect to electrical energy source 
¢ Electrical command (manual backup) moves switches 
* Verified visually and electrically 

¢ Mechanical 


¢ Safe = Physical barrier interposed to prevent transfer of explosive, gas, laser or other initiation 
stimuli 


¢ Arm = Barrier removed to allow stimulus to transfer 
¢ Commands can be manual, electrical and/or pyrotechnic 


¢ Verified visually and electrically 


References 19, 20 and 21 
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Figure 21. Cross sectional view of manually operated, explosive transfer safe/arm. 


Safe/arm devices (figure 21) provide positive means for assuring that stray energy or an inadvertent fir- 
ing command does not initiate the entire ballistic train. That is, in the safe mode, a firing command 
(electrical, hot gas, explosive, etc.) cannot be transmitted. Conversely, in the arm mode, a firing com- 
mand can be transmitted. Electrical safing disconnects the firing circuit from the pyrotechnic device, as 
well as provides a short circuit across the bridgewire. Arming allows the firing circuit to be connected 
and the short disconnected. These safe/arm commands are usually provided with stepping motors to 
drive rotating shafts to the desired position. The shaft location is verified by electrical contacts in a sep- 
arate circuit, as well as visually. Mechanical barriers can block initiation signal transfer by rotating a 
shaft or sliding a plate across an interface to seal a passage or prevent explosive transfer through a trans- 
fer charge or cavity. Again, safing and arming commands can be electrical, manual and/or pyrotechnic 
with visual and electrical verification. One of the worst nightmares at a launch site is that a safe/arm unit 
does not properly cycle through its functions. Consequently, elaborate care is applied to seal these 
devices to prevent contamination of moving interfaces and to maintain electrical contacts. Adding to 
this complexity is the use of built-in explosive transfer charges, which require special handling, storage 
and assembly procedures as a pyrotechnic device. 


6-3 Component Safegaurds 
* Components have additional safeguards 
¢ Hazardous material safety data sheets (OSHA) 
¢ Safing pins, Remove Before Flight 


¢ Shear pin strength set to withstand highest level inadvertent input 


¢ Protective caps/connectors for resisting RF, EMI and electrostatic energies 
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¢ Procedures provide final safety protection 
¢ Handling, transport and storage 
¢ Inspection of components 
¢ Checkout of firing systems 


¢ Final assembly 


References 19, 20 and 21 
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Chapter 7 - TEST METHODS AND FUNCTIONAL PERFORMANCE 


7-1 Non-destructive Tests 
¢ Non-destructive test inspection required to assure single- shot item is properly assembled 
¢ Dimensions of components and final assembly 
e X-ray to image high-density materials 


¢ N-ray to image organic compounds (explosive materials) 
Reference 29 


7-2 Functional Tests 

¢ Test methods should represent the function of device 

¢ Shape, size, volumes, masses, materials 

¢ Stroke 

¢ Resistance (friction, shear pin strength, mass, mechanical force) 
¢ Measure input initiation parameters 

¢ Electrical 

¢ Mechanical 

¢ Pneumatic 

¢ Explosive 

¢ Laser 
¢ Measure output 

¢ Work/energy 

¢ Pressure 

¢ Force 

¢ Stroke 


¢ Industry standard measurement for cartridge output, closed bomb, does not represent performance in 
a device 


References 4, 30, 31, 32 and 33 


In order to understand functional performance, test hardware must accurately represent the device 
being tested. As described in Chapter 4, a number of interrelated parameters affect combustion efficien- 
cies and, consequently, the performance achieved. The test program should evaluate both input (initia- 
tion), as well as output performance. The key to evaluation tests is to reduce the expense of testing flight 
hardware by using a controlled, reproducible simulation. The widely used closed bomb firing system is 
shown in figure 22. Although electrical initiation evaluations can be made, such as in figures 23 and 24, 
the closed bomb’s use in measuring the output of cartridges cannot predict performance in a device. 
That is, firing a cartridge into a closed, fixed volume accomplishes no work, and the parameters affect- 
ing combustion efficiencies in a device are not simulated. As shown by the typical pressure traces in a 
closed bomb, figure 25, it is not at all apparent that the two NSI-derived Gas Generating Cartridges 
(NGGC) can produce more than twice the energy of the two essentially equivalent initiators, the Viking 
Standard Initiator (VSI) and the NASA Standard Initiator (NSI). The energy delivered by the NGGC, as 
determined by a specific output test described in section 7-3-1, was 750, versus 340 inch-pounds for the 
VSI. 
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Figure 23. Typical current versus bridgewire break function time curves to evaluate electrical initiation 
characteristics of cartridges. 
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Figure 24. Typical current versus first pressure indication function time curves to evaluate electrical 
initiation characteristics of cartridges. 
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Figure 25. Typical pressures produced by cartridge firings in a closed bomb. 
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7-3 Types of Functional Performance Tests and Determination of Functional Margin 
¢ Examples of functional performance tests 


¢ Piston/cylinder configurations 


Ignitability 

¢ Explosive transfer or initiation of explosive acceptors 
¢ Explosive severance/fracture 

¢ Flexible linear shaped charge (FLSC) 


¢ Lockheed’s “Super*Zip” separation joint 


Structural containment 
¢ Functional margin (“how well” something performs) is determined by measuring and comparing 
¢ Energy required to accomplish function to Energy deliverable by pyrotechnic source 


* Relative rate of ignition produced by one initiator type to That produced by other initiators under 
consideration 


¢ Determining minimum explosive load to accomplish function (while maintaining flight configura- 
tion) to flight explosive load 


¢ Determining key functional parameters, measuring their performance at limits of functionality to 
flight configuration 


(For example, plate severance is enhanced by the bending of the plate during fracture; tests would 
be conducted at the thinnest and thickest limits of the plate.) 


¢ Uniformity of performance is key to understanding 
* Conduct multiple tests, 5 to 10 minimum 
¢ Provides adequate definition if standard deviation is a small percentage of the mean 


Serious shortcomings exist with “go/no-go testing” and the widely cited +/- 15% “margin demonstra- 
tion criteria.” 


“Go/no-go testing” is accomplished by assembling devices and firing them without measuring func- 
tional parameters. That is, they either do or do not accomplish the desired function. The shortcoming is 
that there is no way to determine how close the device was to failing, either through inadequate func- 
tional or structural containment margins. In testing identical devices, more than 2000 successful, con- 
secutive functional tests would have to be conducted to obtain a simplistic reliability prediction of 
99.9%. 


Margin criteria for pyrotechnically actuated devices were first created for the Gemini Program in the 
early 1960’s. These criteria are the go/no-go firing of a few devices at 15% under and over-load to dem- 
onstrate that an 85% pyrotechnic load would still function the device and a 115% overload would not 
cause rupture of the device. Although these criteria implied some confidence in performance, no quanti- 
tative information is produced. Also, under certain conditions, the performance of pyrotechnic devices 
actually increased with an 85% load. 


The following test methods are recommended to overcome these shortcomings. 
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7-3-1 Recommended functional tests for piston/cylinder configurations 


¢ Energy required measured by dropping mass onto piston to find minimum energy required to 
accomplish function 


¢ Energy deliverable determined by measuring 
¢ Crush of honeycomb: Energy = Crush Distance X Strength 


* Velocity of moving mass: Energy = 1/2mv2 
References 4, 30, 31, 32 and 33 


The energy required to accomplish the stroking of a piston in a mechanical function is determined by 
controlled drop testing of small masses onto the piston to be stroked. The energy required to accomplish 
the function is the drop height multiplied by the weight to provide a value in inch-pounds. Ideally, a 
high velocity of the falling mass simulates the dynamics of the pyrotechnically driven piston. While this 
simulation may not be perfect, it is certainly better than the current practice in which sellers and users of 
pyrotechnic devices often have no idea of the energy required for functioning. 


The energy delivered by a gas generating cartridge can be measured by the McDonnell Energy Output 
Test Fixture (Energy Sensor) or by measuring the velocity of the piston. The Energy Sensor, figure 26, 
represents an application of working against a constant force, using calibrated aluminum honeycomb 
against which the cartridge-driven piston strokes. Energy is obtained by multiplying the amount of 
crush in inches by the honeycomb’s crush strength to provide a value in inch-pounds. Several examples 
are shown for various cartridges in table IX: the Viking Standard Initiator (VSI) and the NSI-derived 
Gas Generating Cartridge (NGGC). 
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Figure 26. Cross sectional view of McDonnell Energy Output Test Fixture. 
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TABLE IX - ENERGY SENSOR PERFORMANCE DATA ON TEST CARTRIDGES 
(Average/Standard Deviation) 


Cartridge No. Fired Energy Delivered inch-pounds 


Performance Baseline (No Environments) 


VSI 5 466/21 
Hi-Shear NGGC 5 815/99 
UPCO NGGC 5 812/90 


Post Environments 
Hi-Shear NGGC 16 869/80 
UPCO NGGC 12 927/58 


To determine energy by measuring the velocity of the piston, the LaRC Dynamic Test Device and a Pin 
Puller have been employed. The Dynamic Test Device, figure 27, represents a jettisoned mass applica- 
tion and employs a one-inch diameter, one-pound mass that strokes one inch to clear the o-ring. The 
velocity of the mass is measured by an electrically grounded needle, mounted on the face of the mass, 
sequentially contacting five, 0.25-inch spaced aluminum foil “make” switches. The 0.25-inch spacing, 
divided by the time interval, yields velocity. The pressure traces produced by several different car- 
tridges (the NSI-derived Gas Generating Cartridge (NGGC) and the Viking Standard Initiator (NSD) are 
shown in figure 28. These pressure measurements cannot be used as a direct indicator of energy deliv- 
ered by the cartridge. Once the total energy is measured for any particular pressure trace, the integral of 
a different trace, which was produced in the same device, can be used as a relative indicator of energy 
for the second trace. 
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Figure 27. Cross sectional view of NASA LaRC Dynamic Test Device. 
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Figure 28. Typical pressure traces recorded and the energies produced in firing cartridges in the 
Dynamic Test Device. 


The NASA Pin Puller, figure 29, was developed for a spacecraft function, and because it has rugged 
steel construction, it has been useful for comparative testing. In this case, energy was measured by the 
velocity of the pin and the amount of crush in the calibrated Energy Absorbing Cup, which crushed at 
the end of the stroke. Typical pressure traces for the VSI and NGGC in the Pin Puller are shown in fig- 
ure 30. The test setup for this data collection allowed the piston to jettison, rather than stopping at the 
end of stroke. A logical question in comparing the energy delivered by the same cartridges in three dif- 
ferent test devices is “Why isn’t the energy the same?” The Energy Sensor measures more of the energy, 
because it doesn’t vent like the other two test methods. The Dynamic Test Device has a very large pis- 
ton face exposed to the working gas, compared to the Pin Puller. The Pin Puller has a tortuous path for 
the hot gas to pass from the cartridges to the piston; the cartridge starts the flow at 900 from the axis of 
the piston, is forced through a 0.10-inch diameter orifice and then pressurizes a narrow working face of 
the piston. It is also clear that the initial free volumes among the three test methods were completely dif- 
ferent, which caused considerably different combustion of the gas generating materials and pressures 
produced. For example, the area exposed to the hot gas in the Pin Puller produced a considerable heat 
sink, changing both the temperature at which the combustion occurred, and, consequently, the burn rate 
and the quantity of gas produced. The amount of residue (unburned fuel) following the firings in the 
three test methods was testimony to these effects; the Pin Puller had the most. 
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Figure 29. Cross sectional view of NASA Pin Puller. 
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Figure 30. Typical pressure traces recorded and the energies produced in firing cartridges in the NASA 
Pin Puller. 
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These results clearly demonstrate why closed-bomb tests cannot predict performance in a device. Care 
must be taken in the selection of a cartridge energy-measuring method, so that the test closely simulates 
use in the production device. 


7.3.2 - Recommended test for determining ignitability (output initiation performance of cartridges 
and ignition sensitivity of materials) 


e Pressure at one millisecond 


¢ Peak pressure 


References: 34, 35 and 36 


The principle for determining the output ignition performance of initiating devices, such as percussion 
primers and cartridges, is to fire the devices onto a controlled bed of combustible material (referred to 
hereafter as ignition material) and measuring the way this ignition material responds (ignites and burns). 
Conversely, to determine the sensitivity of materials to be ignited a controlled initiator is fired onto the 
combustible material under evaluation. The approach for these determinations is to enclose the ignition 
material in a sealed volume and monitor the rise in pressure, created from the burning material. Intu- 
itively, the better the initiator performs, the more rapidly the ignition material ignites, burns and pressur- 
izes the volume. 


The NASA Ignitability Test Bomb, as shown in figure 31, was initially designed to evaluate percussion 
primers. However, the configuration can be modified to incorporate any type of initiator. The ignition 
material is placed in a hemispherical cavity in the ignition material holder. This holder has vent holes to 
allow the gas to vent to the lower portion of the volume, where pressure is measured. The percussion 
primer is installed in the primer holder, which is sealed within the adaptor. A firing pin is installed into 
a port within the adaptor, and rests on the percussion primer. A weight is dropped onto the firing pin 
from a controlled height to assure adequate initiation of the primer. The data recorded on a high-speed 
magnetic tape recorder consists of the strike of the firing pin, as measured by an accelerometer mounted 
on the drop weight, and two pressure traces. Figure 32 shows the pressure produced as a response to the 
input of two different percussion primers, the M42C1 and M42C2 fired into 200 milligrams of FFG par- 
ticle size black powder. Clearly, the M42C1 ignites the black powder more quickly. 
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Figure 32. Typical pressure traces produced by the M42C1 and M42C2 percussion primers in the 
NASA Ignitability Test Method, using 200 mg of FFG black powder. 
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Figure 33 shows how these data were compiled for analysis. The time from the firing pin strike to an 
indication of 100 psi pressure was defined as primer output delay. This is a slightly longer time interval 
than that required for the primer to be initiated by the firing pin. Because the first indication of pressure 
rise is often difficult to detect, the 100 psi level was arbitrarily selected. This level provides a more pre- 
cise start point. The pressure achieved within the first millisecond, following the 100-psi pressure level, 
was selected for ratioing to the peak pressure achieved, and was defined as ignitability. The initiator that 
produces a higher pressure at one millisecond, as compared to other initiators, indicates a greater ignit- 
ability and thus, a faster initiator. The initiator selected for any particular application does not necessar- 
ily depend on a high rate of ignition; some applications, such as initiating time delays, require a soft, 
slow initiation, so as to not to damage the delay columns. 
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Figure 33. Percussion primer ignitability performance definitions. 


The ignitability Test Method can be similarly applied to any initiator, whether electrical, explosive or 
laser. 


For evaluating the relative sensitivity of various ignition materials, figure 34 shows the response of 
three different materials to initiation inputs from M42C1 and M42C2 percussion primers. Clearly, the 
FFG black powder was more sensitive to ignition than was the much coarser A cannon black powder. 
The most difficult to ignite was the Type I particle size BKNO3. The same ignitability definition, ratio- 
ing the pressure achieved at one millisecond to the peak pressure, applies. 
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Figure 34. Ignitability comparison of three ignition materials, each ignited by the M42C1 and M42C2 
percussion primers. 


7.3.3 - Recommended Tests for Explosive Transfer 
¢ For explosive transfer from a donor to an acceptor, measure 
¢ Fragment velocity/energy delivered by the donor 


¢ Fragment velocity/energy required to initiate 
References 5, 23, 24, 29, 30, 31, 37 and 38 


Initiation of high explosives across hermetically sealed interfaces is accomplished primarily by high 
velocity fragments from the donor. In the case of explosive transfer lines (described in Chapter 5) the 
0.005-inch wall thickness 302 stainless steel cup fragments, and the particles accelerated to velocities of 
8,000 to 10,000 feet/second as the 65-milligram explosive load within the cup explodes. The shape, 
impact pattern and velocity of the fragments depend on parameters such as: 1) cup material, properties 
and thickness, 2) explosive material, particle size and loading pressure, and 3) the medium through 
which the fragments pass (usually air). The test setup used to monitor the donor- delivered fragments is 
shown in figure 35. Fragments are created off the end and off the side of the cup. Aluminum foil “make” 
switches, spaced known distances from the cup provide time intervals to calculate velocities. The 
energy delivered by these fragments is obtained by calculating 1/2 mv2, where m is the mass of either 
the end or side of the cup. The impact patterns, created by these fragments, are obtained using the 
acrylic witness plates. Explosive transfer line performance has been uniform and reliable over the 30- 
year history of their application. 
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Figure 35. Schematic diagram of test fixture to monitor fragment patterns and velocities from rigid 
explosive transfer line end tips. 


The energy required to initiate an acceptor explosive is obtained by impacting acceptors with fragments 
of known velocities. To determine the minimum threshold for initiation, donor tips were manufactured 
with smaller quantities and densities of explosive materials, as well as using different types of donor 
cup materials. 


7.3.4 - Recommended Tests for Explosive Severance/Fracture 

¢ For linear explosive severance/fracture, use tapered plate 

¢ Flexible linear shaped charge (FLSC) 

¢ Mild detonating fuse 

* Lockheed’s “Super*Zip” separation joint 
¢ Measure maximum fracture capability in each test 
¢ Test setup must simulate flight applications 

¢ Structure 

¢ Material properties 

¢ Explosive load 

¢ Explosive backup 


¢ Functional margin achieved by sizing explosive load, based on the ratio of either: 
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* the explosive flight load to the minimum explosive load required to sever structure 


or 


¢ The minimum structural thickness severed by the flight explosive load to the flight structural 
thickness 


References 30 and 39 


The use of tapered plates, as shown in figures 36 and 37 provides a way of determining the limit perfor- 
mance of each length of linear explosive for every test. That is, the maximum thickness of the plate is 
set so that the linear explosive cannot fracture along its entire length. With this method, system 
parameters, such as explosive load, sheath materials and separation distance between the explosive and 
the plate to be severed can be optimized. For this information to be applicable to the flight system, the 
test setup must accurately simulate the flight configuration. The linear explosive test fixture in figure 36 
shows a method to measure the severance capability, as well as the energy delivered by a length of the 
explosive (using the McDonnell Energy Sensor), and the velocity of explosive propagation down the 
length of the explosive. Figure 37 shows the test setup for the Lockheed “Super*Zip” separation joint in 
which an explosively expanded tube fractures plates on both sides of the tube at the notched area (liga- 
ment). For this investigation the thickness of the plate was tapered and the depth of the notches was held 
constant. The most influential parameter in achieving fracture was the thickness of the plate; the plate 
must bend at the bolt line to fail at the notched areas in tension. 
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Figure 37. Lockheed Super*Zip separation joint tapered plate test configuration. 
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7.3.5 - Recommended Tests for Demonstration of Structural Containment 
¢ Successful functioning shall not create a hazard 
* Venting of fluids/gases 
¢ Fragments/debris 
¢ Require fail-safe demonstrations 
¢ Lock-shut (fire, while preventing mechanisms from stroking) 
¢ Function with minimum containment structure 
* Increase explosive load 
¢ Reduce initial free volume in combustion chamber 
¢ Functional margin based on comparing 
¢ Flight structure to minimum structure that maintained integrity 
¢ Explosive load where rupture occurred to flight explosive load 
¢ Pressure where rupture occurred to flight pressure 


Note: It is not necessary to test devices to rupture failure if acceptable structural margin can be 
demonstrated. 


References 20 and 21 
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Chapter 8 - FUNCTIONAL RELIABILITY 
¢ Device reliability achieved by 
¢ Understanding of device mechanism through development 
¢ Effects of variables 
¢ Functional limits 
¢ Energy delivery mechanisms 
¢ Effects of environments 
¢ Determining functional margins 
* Qualification testing/environmental survivability 
¢ Measure performance before and after environments 
¢ Compile further performance data to substantiate functional margin demonstration 
* Go/no-go testing of a small number of devices does not measure reliability 


* Reliability can be determined by statistical comparison of energy required to energy deliverable 
References |, 4 and 40 


Functional reliability must be evaluated on each device. Each device should be evaluated through three 

phases: development, determination of functional margins, and qualification. This should be followed 
by system integration and demonstration. The information collected throughout this effort can be ana- 
lyzed to produce classical statistical reliability estimations. Every test firing should be designed to pro- 
duce functional data that will contribute toward defining reliability. 


For each component, functional evaluations should be conducted to understand the device’s mecha- 
nisms and the effect of parameter variability. Tests should be conducted to functional limits. That is, 
tests should be conducted to determine where devices fail to function to evaluate parameters, such as 
structural strength and minimal pyrotechnic energy input, and where structural failures (rupturing) 
occur. The manner in which energy is delivered within and by the device should be determined. The 
most influential environment affecting combustion is temperature. At cold temperatures, both ignition 
sensitivity and burn rate decrease. This combination normally produces the lowest energy output. At 
high temperatures, the reverse occurs. Also, at high temperatures, structural strength can be reduced. 
The combination of higher combustion efficiency and lower structural strength can push devices 
beyond structural limits. 


Currently applied go/no-go tests do not provide information on functional performance, and contribute 
very little to reliability predictions. When a device successfully passes qualification testing, which typi- 
cally requires 10 to 200 firings, the specification reliability is assumed to have been met. The reliability/ 
confidence predictions currently in existence have been created by compiling the success of past 
devices that are remotely similar to a particular device under evaluation. Unfortunately, this logic is 
flawed, since the primary assumption in large-sample statistical evaluation is that all devices in the sam- 
ple are identical. Examples of devices that have achieved significant, large-sample statistical demon- 
stration from actual firings are explosive transfer lines and the NASA Standard Initiator (NSD. 


A Statistical reliability estimate can be obtained through the analysis of all the functional performance 
data collected through development, qualification, integration and checkout of the device under evalua- 
tion. As shown in figure 38, comparing the distributions of energy required to perform a function to the 
energy delivered will provide a statistical baseline. Clearly, the greater the separation between these two 
distributions the more assurance that the function will be accomplished. the 3.89 standard deviation 
refers to a typical distribution where 99.9% of the data is included. However, if the two distributions 
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overlap, failures can occur. Statistical tables, as described in reference 40, predict reliability, based on 
small-sample distributions. 
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Figure 38. Graphic representation of statistical design margin, comparing normal distributions of 
energy required to perform a function to energy supplied by a cartridge. 


¢ System reliability enhanced by redundancy 
¢ Use of parallel, independent paths to perform a single function 
¢ Prevent single-point failures 
¢ Degree of redundancy depends on system tradeoffs 
¢ depends on criticality of function 
* achieved by design approach 
¢ Use of redundancy to assure success introduces contradictions 
* Increases complexity of systems 
¢ Increases chances of inadvertent functioning 


* Does not alleviate need for quality assembly or functional margin demonstrations of components and 
interfaces 


Reference 1 


Redundancy is defined as accomplishing a function through two completely independent paths. In 
example A, figure 39, two electrical firing systems each give a command to Single Bridgewire Apollo 
Standard Initiators (SBASI, the predecessor to the NSI), which in turn ignites the cartridge energy 
sources to one of two devices, such as pin pullers, either of which releases an interface to accomplish a 
desired function. In this case, each system works independently without any influence on the other. 
However, as shown in example B, the two pin pullers could be designed to directly accomplish the 
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function without an interface. In example C, two independent systems through the cartridge level could 
provide inputs into a pin puller; in this case, either cartridge has sufficient energy to independently actu- 
ate the pin puller and accomplish the function. Finally, independent SBASIs could be used to ignite a 
single cartridge to actuate the pin puller. Single point failures occur in the system in example B, the sys- 
tem and the pin puller in example C, and the system, device, and cartridge in example D. The level of 
redundancy depends on the criticality of the function and is achieved by design. That is, simplified 
designs may actually be an improvement over total redundancy. For example, system complexity in 
terms of the number of components and interfaces can increase the opportunity of failure. Furthermore, 
the possibility of inadvertent functioning increases with twice as many firing systems. In any case, the 
use of redundancy does not alleviate the need for designing, demonstrating and producing components 
and interfaces of the highest quality and with the ability to resist inadvertent functioning or failure to 
function. Redundant systems should not be counted on to accomplish the function; each system should 
be expected to accomplish the function, even if the other did not exist. 
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Figure 39. Levels of pyrotechnic redundancy established by the Apollo Program. 


A special word of caution is warranted for the use of cross- overs in explosive transfer lines, figure 40. 
Designers have fallen into the trap of putting cross-overs at the output tips of devices, such as time 
delays. The concept is that, since the output of time delays won’t function simultaneously, the earliest 
arrival will trigger the system. Or, if one path had stopped functioning, a cross-over would reinitiate that 
path. However, the fallacy lies in the possibility that the first input to arrive may cause the cross-over to 
malfunction, which in turn can destroy the second time delay output, causing a loss of propagation in 
the second path. 
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This discussion on success and failure leads to the contradictory problem faced by the pyrotechnic spe- 
cialist. As shown in figure 41, the need to prevent inadvertent initiations must be balanced against the 
need to assure that initiation has been achieved. To prevent initiation, all of the safety features described 
above are employed. These features may be so successful that initiation is prevented. A great deal of 
effort must be made in assuring that these safety features are successfully disabled to properly “arm” the 
system to allow an initiation command to be transmitted. Conversely, to assure initiation is achieved, 
the sensitivity of devices to initiation commands must be increased to a reasonable level without unduly 
impacting safety features. 
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Figure 40. Example of false redundancy in the use of explosive crossovers. 
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Figure 41. Depiction of the need for the pyrotechnic specialist to meet both safety and reliability 
requirements. 
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Chapter 9 - SYSTEM APPROACH FOR APPLICATION OF PYROTECHNICS 


¢ Appoint a pyrotechnic manager 
* Compile system requirements 
¢ Performance 
¢ Physical envelope 
¢ Interface with flight vehicle 
¢ Environments 
¢ Schedule 
* Reliability/simplicity 
¢ Service 
* Cost 
¢ Project experience 
¢ Management preference 


The most important task for project management is to recognize that pyrotechnics must be a separate 
engineering discipline from those that are obvious, such as structure, electrical power, propulsion, 
telemetry and thermal control. Pyrotechnic subsystems accomplish a wide variety of critical functions, 
such as initiation, staging, ejection and release, and, consequently, must interface with most other on- 
board systems. 


A compilation of the requirements on a quantitative basis is the most valuable framework for driving the 
design, development, qualification and integration of pyrotechnic systems. Realizing that tradeoffs will 
have to be made throughout the effort, flexibility in requirements and approach must be emphasized. A 
classic example is establishing a requirement for emergency escape from an aircraft over a range of zero 
velocity/zero altitude through supersonic speed at high altitude. The problem is that escape under super- 
sonic conditions may require many times the cost, time and effort, than for subsonic escape. Histori- 
cally, the preponderance of in-flight escapes for supersonic aircraft have been at subsonic conditions. 


The two statements on project experience and management preference cannot be discounted. It is often 
wise to continue the use of hardware and logic that is well proven and is familiar to project personnel. 
Project management often has a preference, based on experience, which becomes the baseline from 
which all concepts are compared. That is, when another approach is offered, advantages and disadvan- 
tages should be compared to the project experience and preference. 


* Compile history of similar past applications 
¢ NASA LeRC compiling catalog 
* Contact past program managers/designers 
¢ Drawings 
¢ Functional performance/understanding 
¢ Environmental demonstrations 
¢ System performance 
* Negotiate/select approach and functions that most closely meet requirements 
* Cannot be unilateral decision 
¢ Interfacing system managers may not appreciate pyrotechnic engineering logic 


This kind of homework is valuable in preparing trade studies and supporting recommendations. Unfor- 
tunately, few projects have the time to document the logic used in making selections of devices. Even 
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more important is determining the “pedigree” of the selected hardware: 1) development history, includ- 
ing functional margin demonstrations, 2) qualification demonstration, and 3) lessons learned from fail- 
ures. Since there is very little engineering training in the unique energy sources offered by pyrotechnics 
(reference 3), personnel with limited hands-on experience are often assigned and reluctantly accept pro- 
gram responsibility. Few positions within a project require such preparation (starting from a modest 
technology baseline with limited definitive standards or specifications for design, development, qualifi- 
cation and integration). Consequently, when the project concludes, these personnel are grateful to have 
successfully “survived” the experience and few stay on in the field for the next project. NASA Lewis 
Research Center is compiling a catalog of pyrotechnic applications and devices, which should be useful 
in beginning the search cycle. Most of the information on pyrotechnic devices is from manufacturers. 
They have listings of past successful applications of their devices and often the qualification reports. 
Unfortunately, since current specifications do not require quantitative functional margin demonstra- 
tions, the insight into how these devices and systems were developed is often lacking. Pyrotechnic 
devices are presented by manufacturers as “off- the-shelf,” like nuts and bolts, needing only “minimal” 
modification to meet the specific requirements of the current mission. The pyrotechnic manager, while 
developing requirements, is faced with digesting this myriad of information from the manufacturers on 
their hardware. 


After compiling needed information, conducting trade studies and making recommendations to the 
project, the pyrotechnic manager must be prepared to negotiate the final approaches. These negotiations 
must be made with the managers that are responsible for systems that interface with the pyrotechnic sys- 
tems. These negotiations will likely continue throughout the life of the project. Recognizing that little 
engineering logic has been available for pyrotechnic applications, it is necessary to assist the managers 
of interfacing systems with the specific information needed to achieve integration. 


* Compile detailed performance requirements 
¢ Determine integration approach 
* Obtain approval from interface managers 


Once general agreement has been achieved regarding the logic and principles to be used in applying 
pyrotechnic systems within the project, detailed specifications can then be compiled. It is important to 
provide information in the specifications that maintains an overview of what the objectives of the pyro- 
technic subsystems are and how the pyrotechnic devices are to be integrated into the system. Managers 
that interface with pyrotechnics must approve the specifications, and be kept abreast of the developmen- 
tal status. 
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Chapter 10 - GENERATE PERFORMANCE-BASED SPECIFICATIONS 


¢ Describe approach to system 
¢ Define system physical and performance requirements 
¢ Define component physical and performance requirements 


¢ Require demonstration of functional margin for components and systems contracted; go/no-go testing 
alone unacceptable 


¢ Require demonstration of environmental resistance (qualification) 


¢ Confirm functional margin in lot acceptance testing: require performance demonstration at a level 
greater than worst-case flight conditions 


Pyrotechnic specifications should be constructed to insure that the functions to be accomplished and the 
logic to be used are clearly understandable. The function for each pyrotechnic device, as well as the 
overall system, should be readily apparent. This will assist in assuring that all interfaces are defined and 
that the end goals are accomplished. Physical envelopes should be defined so as not to restrict the types 
of devices and their functional approaches. Performance of devices should be defined in quantitative 
parameters and margins, based on the functions to be accomplished, rather than attempting to specify 
physical details of design. For example, a pin puller should be described in terms of the loads to be 
accommodated and the functional margins required (energy deliverable by the cartridge, versus energy 
required to accomplish the function). In the field of pyrotechnics, it is very difficult to produce a device 
with a “build-to-print” specification, since very subtle changes can significantly affect performance. 
Every functional test should be designed to yield quantitative performance information; go/no-go test- 
ing should be eliminated. 


Once functional margins have been established for devices under system requirements and conditions, 
then the devices can be subjected to environmental qualification. The design and demonstration accom- 
plished to this point should provide confidence that these devices should be capable of withstanding all 
environments. At this point, quantitative measurements of performance must be non-invasive. Devices 
must be assembled as flight-configured units and measurements cannot influence the performance dur- 
ing functioning. However, external measurements can be made, such as observing the velocity of a pin 
during stroking. Also, quantitative functional data can be obtained after a firing through x-ray and tear- 
down of the device to reveal internal, precalibrated, metal deformation, such as an energy-absorbing cup 
or the amount of penetration of a piston in a tapered bore. 


Performance verification and functional margin demonstration should be accomplished for acceptance 
of new lots of devices. For example, the test should be configured to require a worst-case flight condi- 
tion. Again, quantitative functional data should be collected non-invasively and/or from post-test 
evaluation. 
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Chapter 11 - PYROTECHNIC COMPONENT DESIGN AND DEVELOPMENT 
* Utilize engineering experience 

¢ Energy delivery capabilities 

¢ Materials/configurations 

¢ Scaling 

* Compatible materials 

¢ Pyrotechnic charge 
¢ Monitor functional performance 


¢ Determine/evaluate key functional parameters 
Reference 4 


The first cut at selecting and sizing the device, its components, and its performance should be based on 
the company’s experience with comparable hardware. As described in chapters 3 and 4, the possibilities 
and combinations are nearly unlimited. One approach would be to use existing hardware with minimal 
modifications and hardware that had been qualified previously on a similar application. The foundation 
to a successful design effort is to monitor performance to determine and evaluate key functional param- 
eters; that is, those parameters, when slightly changed, that most influence performance. 


* Conduct development 
¢ Adjust performance to optimize 
* Conduct functional evaluation to limits of requirements 
* Forces/loads 
¢ Materials/conditions 
¢ Environments 
¢ Establish structural integrity 
* Locked shut 
¢ Pyrotechnic overload 
¢ At conditions of maximum stress, i.e. temperature 
¢ Dual-cartridge device must survive simultaneous firings 


¢ Determine functional margin/reliability 
References 4, 20 and 21 


Development should be conducted to optimize the first five parameters (energy delivery, materials/con- 
figurations, scaling, compatibility and pyrotechnic charge) by conducting functional evaluations to the 
limits of requirements. 


Also affecting this optimization is the requirement to maintain structural integrity. That is, the resistance 
to rupture of the pressurized structure can be evaluated by a locked-shut test (preventing stroke or 
motion of a piston), or a pyrotechnic overload at conditions of maximum stress, such as at temperature 
extremes. For those devices that utilize dual energy sources, such as cartridges or explosive cords, for 
redundancy (the device must function with the output of either energy source) firings must be conducted 
with simultaneous initiation of both energy sources. This must be done, even though in the system, only 
one cartridge is fired at a time; the possibility exists that both energy sources can be fired. Functional 
performance measurements should be taken during these tests to quantify the degree to which structural 
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containment was achieved, or how close the structure was to failing. Maximizing the performance of a 
device is contradictory to maintaining structural integrity. That is, using a large pyrotechnic charge to 
achieve a large functional margin will increase the potential of structural failure. A second contradictory 
factor is the generation of pyrotechnic shock, described in chapter 13, which is increased by greater 
dynamics from large pyrotechnic loads. 


At this point, the structural margin and reliability of the device, as described in chapters 7 and 8 can be 
determined. 
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Chapter 12 - QUALIFICATION 


¢ Determine the survivability of design to environments 
¢ Demonstrate subsystem performance 
* Compile additional data on functionality (margin) 
* Various test philosophies 
¢ Test all units through all environments 
¢ Subdivide test units to allow sequential exposures 
¢ Number of test units depends on: 
* Criticality of subsystem 
¢ Expense 
* Complexity 
¢ Ease of evaluation 
¢ Final firings should be conducted in system-level tests 
¢ Worst-case loads 
¢ Worst-case environments 


¢ Structural integrity 
References 2, 4, and 41 


The objectives of component and subsystem qualification are to demonstrate the capability to withstand 
environments and to compile additional information on performance. By determining the level of per- 
formance, based on dynamic or passive energy measurements, this data will provide further substantia- 
tion of functional margin demonstrations. Two basic approaches exist in regard to conducting 
environmental exposure tests: 1) exposing all test units to all environments, and 2) subdividing the test 
units for sequential exposure to environments. For example, with 5 groups of test units and 5 environ- 
ments, group | would be subjected to environment 1 and functionally tested, group 2 would be sub- 
jected to environments 1| and 2 and functionally tested, group 3 would be subjected to environments 1, 2 
and 3 and functionally tested, etc. With a thorough understanding of the effects of environments from 
the developmental effort, qualification testing should produce no surprises. However, without a thor- 
ough development, test units are subdivided for sequential exposures. This allows for determination of 
which environment had a deleterious effect on performance. At the conclusion of environmental expo- 
sures, the test units should be functioned at physical and environmental extremes, as well as demon- 
strate structural integrity. 
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Chapter 13 - PYROTECHNIC SHOCK 


¢ Pyrotechnically induced mechanical environment 
¢ Suspected cause of Galileo computer memory loss 
¢ Magellan, Mars Observer powered down before firing pyrotechnics 
¢ Dynamic, impulsive compressive/tensile waves generated by: 
¢ Rapid pressurization of gas-actuated mechanisms 
¢ Impact of mechanical interfaces 
¢ Sudden release of loads at loaded interfaces 
* Contains frequencies to over 40 khz 
¢ Dynamicists/accelerometers ignore readings above 10 khz 
¢ Accelerometers resonate, produce large output 
¢ Limitations on simulators 
¢ Assume higher frequencies do not damage 
¢ Viking project required pyrotechnic shock testing 
¢ Impacting mass simulator induced considerable damage 
¢ Abandoned above approach for system-level demonstrations 
* Recommend system-level demonstrations 
¢ Actual or closely simulated structure 
¢ Actual pyrotechnic devices 
¢ Test item mounted on structure as flown 
¢ Eliminates concern of simulation 
* Comparison testing 
¢ Use Hopkinson Bar with strain gages 
¢ Frequency response to 80 khz 


¢ Each pyrotechnic design generates reproducible strain 
Reference 42 


Recent spacecraft failures have been associated with a mechanical environment called pyrotechnic 
shock. Following the loss of memory on a backup computer in the Galileo spacecraft, the Magellan and 
Mars Observer spacecraft have been powered down, prior to firing pyrotechnics. A firing command for 
pyrotechnically actuated valves was the last signal to be transmitted to the Mars Observer before com- 
munications with the spacecraft were lost. Since the spacecraft had no onboard systems in operation, no 
diagnostic information could be obtained to analyze the failure of the spacecraft. 


When pyrotechnic devices are functioned, dynamic, impulsive waves of compressive and tensile strain 
are produced within the device and through the release of loads at structural interfaces. On functioning, 
pyrotechnic devices produce strain by rapid, high pressurization of gas-actuated mechanisms and the 
impact of these mechanisms at the limits of the function. An example of the sudden release of loads is a 
bolted interface released by explosive bolts. These strain waves contain frequencies to over 40 khz. A 
10 khz upper frequency level is an artificial constraint applied by dynamicists, due to the limitations of 
accelerometers and the equipment used to simulate pyrotechnic shock inputs. An assumption is made 
that frequencies above 10 khz cannot damage structure. However, small-mass electronics have exhib- 
ited sensitivities in this regime. 
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Pyrotechnic shock testing was an early requirement on the Viking Program, the soft landing of two 
instrumented payloads on the surface of Mars. Impact test pyrotechnic simulations always produced 
severe overtests, destroying many test items. The pyrotechnic shock simulation requirements were con- 
tinuously reduced and, ultimately, were abandoned in favor of system-level demonstrations. 


Only system or subsystem pyrotechnic shock tests should be conducted, using the actual or closely sim- 
ulated structure, with the actual pyrotechnic device and the test item mounted and functioned as in 
flight. To compare the shock produced by various pyrotechnic devices, a Hopkinson bar setup should be 
employed. 


The complex shock waves generated by individual pyrotechnic systems, monitored on a Hopkinson bar 
with high-response (80 khz) strain gages, have demonstrated a remarkable degree of reproducibility. 
The Hopkinson bar is a one-inch diameter, 10-foot long steel bar, which represents a simplified struc- 
ture. The shock wave propagates undisturbed down the length of the bar with only a simple reflected 
wave at the end of the bar opposite to the end on which the pyrotechnic device was mounted. The length 
of the bar allowed the complete initial transient pulse to be recorded without interference from the 
reflected wave. Multiple firings (reference 39) of separation nuts produced strain signals that overwrote 
one another. 


However, pyrotechnic shock simulation is questionable, since the dynamics of a mechanism are diffi- 
cult to duplicate and the accelermometer-based data acquisition cannot provide linear response. There- 
fore, it is difficult to be assured of good simulations, risking the possibility of over or under- testing. 
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Chapter 14 - FAILURE MODES AND EFFECTS ANALYSES 


* Consider and list what can “go wrong,” such as: 
¢ Improper assembly (mechanical hardware and firing system) 
¢ Inadvertent command 
* Out-of-sequence command 
¢ Mechanical hangup 
¢ What can result if incidents occur 
¢ Put emphasis on preventing incidents and demonstrating system capabilities 
¢ Device and system design/functional margins 
¢ Personnel awareness 
¢ System schematics/diagrams 
¢ Procedures 
¢ Use mockups of devices and subsystems 


Failure Modes and Effects Analyses (FMEAs) are more than just a paperwork game to be played after a 
pyrotechnic device and its application have been designed, developed and qualified. FMEAs (what can 
“go wrong,” and what can result) should be considered throughout the effort, from the earliest conceptu- 
alizations, through qualification. In fact, considering FMEAs at the conclusion of the design process is a 
mistake, since it is almost certainly too late to modify devices or system designs. The emphasis should 
be placed on preventing incidents and demonstrating device and system capabilities. The best way of 
preventing failures is through design, using logic, such as the positioning of components to assure 
proper assembly and the demonstration of functional margins. Equal in importance is the awareness of 
personnel concerning what the system is supposed to accomplish and how, by way of device and sub- 
system schematics, as well as system diagrams and assembly and checkout procedures. 
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Chapter 15 - INSTALLATION, INTEGRATION AND CHECKOUT 


¢ Final assurance system will accomplish the required task 
¢ Require end-to-end schematics/diagrams 

¢ Show all commands (software) 

¢ Electrical wiring and switching 

¢ Required end function and location 

¢ Labeled interfaces 
¢ Simplified labeling of all components and interfaces 
¢ Provide detailed mockups of final functions (since flight pyrotechnics cannot be functioned) 
¢ Require end-to-end checkouts 

¢ Power up electrical firing circuits 

¢ Verify proper firing signals, related to commands 


¢ Verify signals reached the correct point for function 
Reference 43 


Installation, integration and checkout is not only the final assurance the system will accomplish the 
required task, it is the last opportunity to detect and correct any flaws in the hardware or software of the 
systems. Since pyrotechnic devices generally cannot be functioned during checkout of electrical or 
other firing systems, it is imperative that personnel are aware of what they are testing and what is 
expected to occur on any given firing command. This information should be included on end-to-end 
system schematics, diagrams and procedures. One drawing should contain sufficient information, 
(referring to supporting drawings, hardware and procedures), to allow personnel to trace an entire com- 
mand subsystem from generation (what the command is supposed to look like), through how it is trans- 
ferred to the pyrotechnic device, and what is supposed to occur when the command is received. 
Simplified, standardized labeling should be continuous throughout all of the components of a sub- 
system; do not allow labeling to be independent among individual subsystems and designers. Accurate 
mockups (with appropriate sensors and indicators to acknowledge the arrival of the command) of the 
devices and subsystems into which these firing systems are to be installed are also valuable in assuring 
that the system will function as required and that the correct installations will be accomplished. That is, 
personnel should be able to understand that command A should be transmitted through electrical circuit 
A to fire the primary energy source, not just that a final connection was made. End-to-end checkouts 
should be performed on the assembled subsystems by powering up electrical (or other) firing circuits to 
verify the proper firing signals were generated, and related to the commands at the correct sequence, as 
well as to verify that the signals were correct and reached the correct point to accomplish the function. 


The problem encountered, particularly by large projects, is the lack of ownership of the pyrotechnic 
hardware. That is, no one assumes the responsibility of assuring the success of the hardware in meeting 
the required function from design through the final installation and checkout. Unfortunately, the same 
personnel generally do not follow the hardware throughout its lifetime, and it is handed from one orga- 
nization to another to accomplish each phase of the program. At each interface, the next team may 
assume that their predecessors did their job, and details in understanding the hardware can be lost. 
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Chapter 16 - SHELF AND SERVICE LIFE EVALUATION 


¢ Shelf and service survivability demonstrated by performance 
¢ Determine/utilize key performance parameters 
¢ Establish a performance baseline 
¢ At original manufacturing cycle 
* Or use youngest available, identical units 
¢ Sample and function units from shelf/service 
* Compare to baseline 
¢ Frequency of sampling dependent on 
¢ Design 
¢ Performance 


* Criticality of function 
References 37 and 38 


The survivability of pyrotechnic devices under long-term shelf and service conditions should be evalu- 
ated by demonstrating performance before and after such exposures. The long-term stability of devices 
cannot be accurately predicted, nor demonstrated through accelerated aging techniques. Past assump- 
tions have been made that 1) all reactive materials have a predictable deterioration mechanism to allow 
predictions of allowable lifetimes, and 2) elevating the temperature would predictably accelerate the 
deterioration. 


Key performance parameters must be determined and a baseline established for comparison to the per- 
formance produced by devices removed from the shelf or after a long time in service. For example, in 
the evaluation of rigid explosive transfer lines, functional measurements included the velocity of explo- 
sive propagation down the explosive cord, and the velocity and pattern of the explosively accelerated 
fragments off the end and side of the transfer cups. The purity of the explosive materials was evaluated, 
and degradation studies were conducted, which corroborated functional performance decreases with 
loss in chemical purity. However, for percussion primer-initiated devices, a chemical analysis of the 
multi-ingredient primer mix would be not only complex, but would be difficult to correlate to functional 
performance. Furthermore, the failure modes of percussion primers are contamination and displacement 
of the mix, due to mechanical inputs, such as vibration. Therefore, the evaluation emphasis was placed 
on determining functionality with the highly sensitive ignitability test method. 


The frequency of removing samples from service for evaluation depends on the design, the performance 
of the device and the criticality of its function. To use the rigid explosive transfer line example, the 
design of the line provides for hermetic sealing of all explosive materials, the materials selected were 
extremely pure and very stable under time and temperature, and the assemblies were very rugged with 
the explosives compacted at 32,000 psi. The performance of transfer lines is highly reproducible, pro- 
ducing standard deviations of 1 to 5% of the mean values of performance. Obviously, transfer lines 
serve a critical function, initiating virtually all the escape system functions in a wide variety of fighter 
aircraft. Therefore, the original allowable service life was 18 months before changeout and further eval- 
uation was required. However, as experience increased, service life was extended with the finding that 
lines removed from 9 years of service on Army helicopters could not be functionally or chemically dif- 
ferentiated from new lines. The Army is leaving all these lines in their fleet, removing a sample of units 
at periodic intervals for evaluation, and expecting no changes for the lifetime of their aircraft. For the 
Air Force’s B-1B aircraft, service life was extended from 3 to 20 years in a single step. 
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Chapter 17 - PAST EXPERIENCE AND LESSONS LEARNED 


Two examples of past failures of completely different pyrotechnic devices are provided to present logic 
for evaluation and correction. 


17-1 - Failure Investigation of Viking Pin Puller 

¢ Successful performance on Mars Lander 
¢ Planned to utilize original hardware lot, 20 years later 
¢ Second user had failure 

¢ Duplicate unit 

¢ Same manufacturer 

¢ Same design/drawings 
* Contributors to failure 

¢ Lack of o-ring seals 

¢ NSI combustion inefficiency/quenching 

¢ Deformation of cylinder bore 


¢ After redesign, pin puller went from inadequate functional margin to a capability of 6 times the 
energy required to stroke 


¢ Confinement margin demonstrated by dual-cartridge firing at 2000F under vacuum 
Reference 4 


Following the successful use of the Viking Lander pin puller (figure 42) on the surface of the planet 
Mars, two other programs selected it for further application. A NASA Langley Research Center project, 
the Halogen Occultation Experiment (HALOE), used residual Viking pin pullers. The Jet Propulsion 
Laboratory (JPL) planned to go to the manufacturer of these pin pullers to produce another lot, conduct 
a delta- qualification for their unique requirements, and fly it on the Magellan spacecraft. However, 
early in their evaluation effort, a unit only stroked half the required distance. Following a JPL analysis 
and resolution, another unit failed to stroke at all. This design was then abandoned by JPL and another 
previously qualified pin puller was selected and used. Meanwhile, NASA Langley Research Center had 
made a commitment to use this device and elected to conduct a failure investigation. 


As shown in figure 42, the energy sources were the Viking Standard Initiators (VSIs), which are virtu- 
ally identical to the NASA Standard Initiator (NSD). Firing either or both units would accomplish the 
function. The outputs of the VSIs each pressurized a blind port, that has a 0.100-inch diameter orifice to 
vent the gas behind the piston. An 80-pound strength shear pin prevented premature motion. An energy 
absorbing cup was crushed by the excess energy achieved by the piston/pin at the end of the stroke. 


The Viking development effort relied on monitoring the peak pressure produced in the pin puller to 
obtain an understanding of functional margin. A transducer was installed in the port opposite to the VSI 
that was fired. It was found through off-loading of the pyrotechnic charge in the VSI that the pin puller 
would function with only half the normal peak pressure. Accordingly, the project assumed a functional 
margin of 2, or twice the capability that was necessary. Furthermore, Viking never experienced a fail- 
ure; more than 150 consecutive, successful go/no-go tests, including a rigorous environmental qualifica- 
tion program and a number of subsystem functional demonstrations were accomplished by the time the 
spacecraft flew. How could a “fully-qualified” device with such a pedigree fail to function 20 years 
later? 
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Figure 42. Cross sectional view of Viking pin puller. 


The Langley failure investigation revealed that peak pressure, as the only test parameter, meant virtually 
nothing. It was also found that the o-ring seals were inadequate: (1) the chemical chromate coating 
(Alodine) was wiped from the interior of the piston bore and adhered to the o-ring, preventing a seal, 
and (2) the molybdenum disulfide/graphite dry lubricant was wiped from the pin and piled up on the 
upstream pressure side of the pin o-rings and prevented a seal. The net effect was to decrease the pres- 
sures achieved in the working volume, and ultimately, to reduce the combustion efficiency and to 
quench the combustion of the cartridge mix. The bottom of the VSI port occasionally deformed to grip 
the piston. 


The resolution was to change the pin puller’s housing material and the dry lubricant on the pin. A steel 
body was flown, but hard-anodized aluminum performed as well under additional testing. The dry lubri- 
cant was an electrolitically deposited nickel/Teflon coating. The energy required to function the pin 
puller was obtained by dropping a small mass onto the pin; drop height, multiplied by the drop weight, 
produced a value of inch-pounds. The energy absorbing capability of the cup was calibrated by increas- 
ing the drop height. Thus, after each firing, disassembling the pin puller and measuring the cup crush 
provided an energy delivery value for the cartridge. These data are summarized in figure 43. A value of 
25 inch-pounds was determined to stroke the piston/pin and deform the energy absorbing cup to prevent 
rebound. In a sample of only 5 pin puller functional tests, conducted using actual spacecraft structure, 
the average value of energy delivered by the cartridge was 165 with a standard deviation (sigma) of 22 
inch-pounds. Assuming a normal probabilistic distribution, statistical tables indicated that the probabil- 
ity of failure for both pin pullers on the mission was equal to or less than 0.4%. That is, the probability 
for success of both pin pullers was equal to or greater than 99.6%. 
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Figure 43. Statistical presentation of functional margin for redesigned HALOE pin puller. 


17.2 - Failure Investigation of Lockheed Super*Zip Separation Joint 
¢ Flew for 20 years as stage and shroud separation 
¢ Failure occurred in ground test at cold temperature 
* Contributors to failure 
¢ Structural material changed from fracture sensitive to fracture resistant 
¢ Did not adequately control thickness of structural material 
* Cold temperature had no effect on performance 
¢ Functional margin: 
¢ Flight explosive load 27% greater than needed 
¢ Capability of fracture 71% greater thickness than needed 
* Confinement margin was demonstrated by 
¢ Determining mechanism that caused tube rupture 
¢ Determined explosive load that induced tube rupture 


* Compared to flight load 
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References 2 and 39 


The Lockheed Super*Zip separation joint was developed and qualified in the late 1960’s for payload 
shrouds (opening the shroud longitudinally and across the nose) and for payload release (circumferen- 
tial, cylindrical severance, as shown in figure 44). In 1984, during a cold-temperature ground-test dem- 
onstration of the Shuttle/Centaur system, the joint failed to separate around the entire circumference. 
This is one of the worst possible failure modes, in that a partial separation would prevent payload 
release, requiring astronaut extravehicular activity to dump the payload. The Shuttle cannot land with 
the partially released payload on-board. Landing loads might cause the remainder of the joint to fail, 
dropping the payload into the cargo bay, and destroying the Orbiter. 


The configurations of this separation joint are shown in figure 45. The principle of operation is the 
explosive expansion of a flattened tube, which induces a tensile load in the material in the two side 
plates between the notched areas and the tube to achieve separation. The explosive cord, on detonating, 
transfers its energy through the rubber extrusion and into the tube. All products of the explosion are 
contained by the tube. The material that was initially selected to be severed was fracture-sensitive alu- 
minum, 7075- T6. The first question is, “Why are the three joints different?” One joint (Galileo) has one 
explosive cord and two (Centaur and IUS) have two cords. Firing either one or both cords achieves sep- 
aration, but firing both cords can cause tube rupture. The first joint has a reduction in thickness at the 
bolt lines in the side plates, and the other two do not. The first joint has a material thickness at the 
notches of 0.025 inch, while the other two have a thickness of 0.042 inch. Different fasteners are used. 
The flanges interfacing the two halves of the system to be separated are different to accommodate struc- 
tural designs selected. The Galileo design was selected for its lighter weight. 
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Figure 45. Radial cross sectional views of three types of Super*Zip separation joints, and the programs 
to which they were applied. 
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Parameters within this system, a portion of which are shown in figure 46, were evaluated, and their 
effects on functionality were quantified. It was learned that the fracture mechanism was the following: 
1) the detonation of the explosive cord caused zones at the notches (ligaments) to be “bruised” or 
preweakened by damaging grain boundaries, 2) the expansion of the tube forced the doublers to bend, 
hinging inboard of the line of fasteners, and an explosive impulse on the major axis of the tube created a 
tensile load in the doubler to 3) structurally fail the ligament. The key point is the bending of the dou- 
bler, which is determined by the cube of the plate thickness. A decision was made by the Shuttle/Cen- 
taur Project Office to anneal the previously qualified 7075-T6 aluminum to a 7075-T73 condition to 
avoid concerns about corrosion-resistant properties of the T6 material. A short panel was made up with 
the T73 material, test-fired successfully and declared acceptable. Unfortunately, the functional margin 
of the system had been reduced to nearly zero. That is, an examination of the doublers in the failed test 
revealed that thicknesses to 0.085 inch fractured successfully, and thicknesses above 0.086 experienced 
separation failures! Thus, while fracture properties of the material was the most important variable, a 
close second was doubler thickness. The evaluation parameter used throughout the experimental effort 
to judge and compare performance was the doubler thickness. 


Web 
(Thickness & ecige 
of tesherer} 


— 
Fosignens. —~ 
(2 rovers] 


Figure 46. Identification of a portion of the parameters evaluated in the Super*Zip separaion joint. 


Using this doubler thickness as a performance parameter, a tapered doubler plate (figure 37) was 
machined to permit the evaluation of a particular variable within a length of 8 inches. That is, as the 
doubler thickness increased, it became stiffer to resist fracture. The doubler thickness was varied from 
0.065 to 0.123 inch to prevent total fracture within the limits of the variables evaluated, but allowed 
maximum severance to be measured in each firing. Figure 47 shows the results of several variables, 
comparing doubler thickness for successful fracture to explosive load. The 7075-T6 doubler material 
easily produced the highest performance in the dual-cord flight configuration. The top curve indicates 
that a single, on-center cord is more efficient than the flight configuration at explosive loads to just 
under 11 grains per foot. At 11 grains per foot, tube splits occurred in the dual-cord configuration, vent- 
ing explosive products. Separate tests revealed that the tube in the single-cord configuration could easily 
withstand much higher explosive loads. The mechanism that produced tube rupture was the impact of 
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the tube against the end ring nearest to the cord fired, inducing a thinning of the tube wall. As the tube 
continued to expand, it failed in tension at this thinned site. 
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Figure 47. Severance performance, comparing web thickness to explosive load, of several configura- 
tions of the Super*Zip seperation joint. 


Explosive margin for this separation joint was established by ratioing loads: 


minimal flight load 
min. load to break thickest doubler 


For the Shuttle/IUS: 2 = 1.27 


A second margin was established by ratioing the plate bending moments for successful severance (plate 
thicknesses cubed) at the minimum flight load to the maximum allowable flight thickness. 


oie : 3 
(minimum severed thickness) 


(maximum allowable thickness) 


(0.098)* _ | 


(0.082) ° 


For the Shuttle/IUS: 71 
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Chapter 18 - DISPOSAL METHODS 


¢ Environmental restrictions 
¢ Burning to atmospheric discharge 
¢ Burial in land fills 
¢ Discharge into streams/water 
¢ Biggest Military problem = base cleanup/weapons disposal 
* Government approach 
* Closed-cycle burning, minimal discharge 
* Chemically dissolving/separation/recycling 
¢ U.S. Army Defense Ammunition Center and School Savanna, Illinois 61074-9639 (815) 273-8901 
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CONCLUSIONS/RECOMMENDATIONS 


Applying pyrotechnic (explosive and propellant-actuated) devices has been considered to be an art, 
rather than an engineering science. When failures occurred after completing qualification, past design- 
ers had few test methods that quantitatively defined performance and functional and structural contain- 
ment margins. Their recourse was limited, other than to provide more pyrotechnic energy. However, if 
this scenario was true, why has the application of pyrotechnics been so successful? What is the need for 
change if so few failures have occurred? Finally, with the failures that have occurred, why haven’t clear 
resolutions been made and specifications improved to prevent recurrence? 


Over the years a number of justifications have been offered. Pyrotechnic devices contain explosives, 
which really can’t be measured because of their high energy levels and dynamics. These devices are just 
like electronic “black boxes;” it is not necessary to understand the internal components. This is the way 
we’ ve always tested these devices. These people know what they’re doing; they have been making and 
applying these devices for a lot of years. Besides, the devices we’re using now are just like the designs 
that have been flying for years. We don’t have time to do research. We have to fix this failure quickly to 
meet flight schedules. Don’t worry, once we get this system together, it’ Il work. Trust me. 


Success with pyrotechnic devices has been achieved through large functional margins. Even though 
functional margins were not defined, it is not difficult to use plenty of explosive or propellant to make 
each device work. The major problem with widely cited requirements (go/no-go testing and +/-15% 
pyrotechnic loads) is that functional or containment margins are not defined. Without failures there is no 
way to determine how close the device is to failure. That is, when the device has a minimal energy 
source, if all the devices within a group (usually numbering less than 200) function, the assumption is 
made that functional reliability is adequate. However, should system parameters vary in an amount that 
would be trivial in pneumatics or hydraulics systems, such as surface finish, o-ring lubrication or the 
initial free volume into which the energy source is fired, failure can occur. Similarly, when the device 
has too large a charge, which could introduce structural failure, the assumption is made that since all test 
units maintained structural integrity containment reliability has been achieved. More than 2000 “‘identi- 
cal” devices must be subjected to simple go/no-go testing to assure functional and structural reliability. 


The primary purpose of this manual is to alter the concept that the use of pyrotechnics is an art and 
refute the above- stated “justifications” that applications don’t need to be understood by providing 
information on pyrotechnic design, development and qualification on an engineering basis. Included are 
approaches to demonstrate functional reliability with less than 10 units, how to manage pyrotechnic- 
unique requirements, and methods to assure that the system is properly assembled and will perform the 
required tasks. 
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